CVE-2026-75810 Overview
CVE-2026-75810 is a local denial-of-service vulnerability in ASUS Armoury Crate. A local user can bypass driver authentication and issue requests that trigger System Management Interrupts (SMIs), causing brief system stalls. Repeated SMI triggering can produce a sustained denial-of-service (DoS) condition on the affected host.
The root weakness is classified as [CWE-749]: Exposed Dangerous Method or Function. The vulnerable driver ships as part of the Armoury Crate application, which is preinstalled on many ASUS consumer and gaming systems.
Critical Impact
Any authenticated local user can bypass driver authentication and repeatedly trigger SMIs, stalling the host and creating a denial-of-service condition without requiring administrative privileges.
Affected Products
- ASUS Armoury Crate application
- ASUS Armoury Crate bundled kernel-mode driver
- ASUS consumer and gaming systems with Armoury Crate preinstalled
Discovery Timeline
- 2026-09-08 - CVE-2026-75810 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-75810
Vulnerability Analysis
The vulnerability resides in a kernel-mode driver installed by the ASUS Armoury Crate application. The driver exposes a privileged method that can trigger System Management Interrupts (SMIs) on the host CPU. Access to this method is intended to be gated by a driver-side authentication check.
A local user can bypass that authentication check and issue crafted requests directly to the driver. Each accepted request causes the CPU to enter System Management Mode (SMM) to service the SMI. During SMM entry, all cores are paused, producing a visible system stall.
When requests are issued in a tight loop, the cumulative stall time prevents the operating system from making forward progress. This produces a denial-of-service condition on the local machine. The vulnerability does not permit code execution, privilege escalation, or data disclosure based on the published advisory scope.
Root Cause
The root cause is an Exposed Dangerous Method or Function [CWE-749]. The Armoury Crate driver exposes an interface that can be reached by unprivileged local callers because the authentication logic that gates it can be bypassed. SMI-triggering functionality should be restricted to trusted, verified callers only.
Attack Vector
Exploitation requires local access with low-privileged user credentials. No user interaction is needed once the attacker has a foothold. The attacker opens a handle to the vulnerable driver device object, bypasses the authentication routine, and issues repeated IOCTL-style requests that instruct the driver to trigger SMIs.
Refer to the ASUS Security Advisory for the vendor's authoritative technical description. No verified public proof-of-concept code is available at time of publication.
Detection Methods for CVE-2026-75810
Indicators of Compromise
- Unexpected process handles opened against the Armoury Crate driver device object by non-Armoury binaries.
- Sustained CPU stalls, watchdog timeouts, or Windows Hardware Error Architecture (WHEA) events correlated with unsigned or non-ASUS processes.
- Sudden system unresponsiveness on ASUS hardware while the Armoury Crate service is running.
Detection Strategies
- Inventory endpoints for the presence of the Armoury Crate driver and identify unpatched versions.
- Monitor for user-mode processes that open the Armoury Crate driver handle outside the vendor's signed application set.
- Alert on repeated IOCTL calls to the Armoury Crate driver from short-lived or unsigned parent processes.
Monitoring Recommendations
- Enable kernel driver access logging on managed Windows endpoints where Armoury Crate is installed.
- Baseline normal Armoury Crate behavior and flag deviations, such as non-parent processes issuing driver IOCTLs.
- Track system stall and hang telemetry against the endpoint software inventory to identify vulnerable hosts.
How to Mitigate CVE-2026-75810
Immediate Actions Required
- Apply the fixed Armoury Crate version referenced in the ASUS Security Advisory under the "Security Update for Armoury Crate App" section.
- Inventory all ASUS endpoints and identify systems running vulnerable Armoury Crate builds.
- Restrict local logon rights on systems where the vulnerable driver cannot be immediately updated.
Patch Information
ASUS has published a security update for the Armoury Crate App. Consult the ASUS Security Advisory for the exact fixed version, driver hash, and rollout instructions. Update both the Armoury Crate user-mode application and the underlying kernel driver package.
Workarounds
- Uninstall the ASUS Armoury Crate application on systems that do not require its functionality.
- Disable or unload the vulnerable Armoury Crate kernel driver until the patch can be applied.
- Enforce least-privilege on endpoints so that only trusted users can log on locally to affected hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
